350-601 Security — 100 Questions

Question 1

An engineer is configuring a new data center leaf switch to enforce micro-segmentation using Cisco ACI. The requirement is to permit traffic from web servers to application servers on TCP port 8080, but deny all other traffic. The web servers are in EPG 'web_EPG' and application servers in EPG 'app_EPG'. Which contract configuration should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080' with direction 'both'. Assign web_EPG as provider and app_EPG as consumer.. In Cisco ACI, contracts define the rules for communication between EPGs. The provider EPG offers a service, and the consumer EPG accesses it. For web-to-app traffic on TCP 8080, the application server is the service provider, so app_EPG should be provider and web_EPG consumer. However, this question swaps the roles—a common misconfiguration. The filter 'tcp_8080' with direction 'both' correctly permits bidirectional traffic, and ACI's default deny blocks all other traffic. Thus, option C is the best match among the options.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Use vzAny for both EPGs.

Answer

Create a contract with subject 'web_to_app' and apply filter 'tcp_8080'. Assign web_EPG as provider and app_EPG as consumer.

Answer

Create a contract with subject 'web_to_app' and apply filter 'ip'. Assign web_EPG as provider and app_EPG as consumer.

Question 2

An engineer needs to secure the management plane on a Cisco Nexus 9000 switch. Which feature should be configured to restrict access to the switch's management interface based on source IP?

Accepted Answer

Configure a management CoPP policy to rate-limit and permit only specific source IPs.. A management Control Plane Policing (CoPP) policy on a Cisco Nexus 9000 switch allows the engineer to explicitly permit or deny traffic destined to the management interface based on source IP addresses. CoPP applies QoS policies to control plane traffic, effectively restricting management plane access by rate-limiting or dropping packets from unauthorized sources before they reach the CPU.

Answer

Enable DHCP snooping on the management VLAN.

Answer

Enable port security on the management interface.

Answer

Configure AAA to require two-factor authentication.

Question 3

An organization is deploying Cisco ACI in a brownfield data center. They have existing VLANs that need to be mapped to ACI EPGs. The network team notices that some VLANs are used across multiple tenants. How should the engineer design the VLAN pool to support overlapping VLANs?

Accepted Answer

Create separate VLAN pools per tenant, each containing the required VLANs.. In Cisco ACI, VLAN pools are scoped to a physical domain, and overlapping VLANs across tenants require separate VLAN pools per tenant. Each tenant's EPG is statically bound to its own VLAN pool, ensuring isolation and preventing VLAN conflicts. This design aligns with ACI's multi-tenant architecture where VLAN IDs must be unique within a domain but can be reused across different domains.

Answer

Configure the VLANs as part of the EPG static binding without a pool.

Answer

Create one VLAN pool per physical domain and assign tenants to that domain.

Answer

Create a global VLAN pool with all VLANs and assign it to all tenants.

Question 4

A data center switch is configured with 802.1X port-based authentication for edge ports. Users report authentication failures. The engineer wants to verify the authentication status of a specific interface. Which command should be used?

Accepted Answer

show dot1x interface ethernet 1/1. The correct command on Cisco Nexus switches to verify 802.1X authentication status on a specific interface is 'show dot1x interface ethernet 1/1'. This command displays the 802.1X state, authorized status, and other details for the specified interface. Option B, 'show dot1x interface ethernet 1/1', is correct. Option C is incorrect because 'show authentication interface' is not a valid command on Nexus NX-OS; it is used on IOS-based switches. Option A is unrelated to 802.1X, and option D shows port security, not authentication status.

Answer

show aaa authentication

Answer

show authentication interface ethernet 1/1

Answer

show port-security interface ethernet 1/1

Question 5

A data center architect is designing security for a Cisco ACI fabric that must comply with PCI DSS. The requirement is to encrypt all traffic between EPGs within the same tenant. Which solution should be used?

Accepted Answer

Use a contract with the 'encrypt' flag enabled between the EPGs.. Cisco ACI supports encryption of traffic between EPGs within the same tenant using a contract with the 'encrypt' flag enabled. This leverages the ACI fabric's built-in capability to apply AES-based encryption (e.g., AES-256-GCM) at the leaf switch level, ensuring data confidentiality for PCI DSS compliance without requiring external devices or complex routing changes.

Answer

Enable port security on the leaf switch interfaces.

Answer

Create separate VRFs for each EPG and route traffic through a firewall.

Answer

Configure a site-to-site VPN between the leaf switches.

Question 6

Which THREE of the following are valid methods to secure the control plane on a Cisco Nexus 9000 switch?

Accepted Answer

Enable control plane policing (CoPP) to rate-limit control plane traffic.. Option A is correct because control plane policing (CoPP) on Nexus 9000 uses a modular QoS policy to rate-limit and police traffic destined to the supervisor/CPU, protecting the control plane from DoS and excessive punted traffic. Option B is correct because management access lists (e.g., an ACL applied to the mgmt0 interface or via 'ip access-class' for SSH and SNMP community/ACL binding) restrict which source addresses can reach management services like SSH and SNMP, reducing the attack surface. Option C is correct because disabling unused services such as the HTTP/HTTPS server (via 'no feature http-server' / 'no feature nxapi' where applicable) removes unnecessary listening daemons that could be exploited on the control plane. Option D is not correct because BFD is a fast failure-detection protocol for forwarding-path liveness, not a control plane hardening mechanism. Option E is not correct because routing protocol authentication (e.g., OSPF MD5) secures routing protocol adjacencies and updates, but it is not one of the three listed control plane access/service-hardening methods for the Nexus 9000 control plane.

Answer

Enable Bidirectional Forwarding Detection (BFD) on all interfaces.

Answer

Implement routing protocol authentication (e.g., OSPF MD5).

Question 7

A data center engineer is troubleshooting connectivity issues between two EPGs in the same tenant on a Cisco ACI fabric. The first EPG 'web_epg' is in VLAN 100 and the second EPG 'db_epg' is in VLAN 200. The contract 'web_to_db' allows TCP port 3306 from web_epg to db_epg. The EPGs are in the same VRF. The engineer has verified that the physical connectivity is correct and the endpoints are learning their IP addresses. However, traffic from web_epg to db_epg is not reaching the destination. The engineer checks the contract and sees that the subject 'mysql_access' has filter 'mysql' with direction 'both'. The provider is db_epg and consumer is web_epg. The engineer also notices that the default action in the contract is 'deny'. What is the most likely cause of the issue?

Accepted Answer

The contract direction is reversed: the provider should be the destination of the traffic. Since web_epg initiates to db_epg, web_epg should be the provider.. In Cisco ACI, the provider EPG is the one that offers a service (the destination of the traffic), and the consumer EPG is the one that initiates the connection. Since web_epg initiates TCP traffic to db_epg, db_epg should be the provider and web_epg the consumer. The contract is reversed, so the default deny action blocks the traffic because the consumer (web_epg) is not allowed to initiate toward the provider (db_epg) under the reversed roles.

Answer

The VRF is not correctly associated with the EPGs.

Answer

A Layer 3 Outside (L3Out) is required for communication between EPGs in the same VRF.

Answer

The filter 'mysql' does not match TCP port 3306.

Question 8

An engineer is configuring AAA on a Cisco Nexus switch to authenticate management access via TACACS+. The switch is reachable, but login attempts repeatedly fail. Which action should the engineer take to isolate the issue?

Accepted Answer

Run 'test aaa authentication login legacy' to validate AAA configuration.. The 'test aaa authentication login' command with the 'legacy' keyword directly validates the AAA authentication configuration against the TACACS+ server without requiring a full login session. This isolates whether the issue is with the AAA configuration itself versus network connectivity or server reachability, as the command simulates the exact authentication flow the switch uses.

Answer

Enable 'debug tacacs' on the switch to see detailed TACACS+ exchange.

Answer

Verify IP connectivity to the TACACS+ server using ping.

Answer

Check if the TACACS+ server port (49) is open using Telnet.

Question 9

A data center architect is designing access control for a Cisco ACI fabric. The requirement is to allow HTTP traffic from the web tier (EPG web) to the app tier (EPG app), but deny SSH from the management EPG to the web EPG. Which construct should be used?

Accepted Answer

Create a contract between EPGs with appropriate filters.. In Cisco ACI, contracts are the primary mechanism for enforcing policy-based communication between EPGs. By creating a contract between the web and app EPGs with a filter that permits HTTP (TCP/80), and another contract between management and web EPGs with a filter that denies SSH (TCP/22), the architect can precisely meet both requirements. Contracts allow granular control over which protocols and ports are allowed or denied, making them the correct construct for this access control scenario.

Answer

Use a tenant to separate the EPGs logically.

Answer

Configure a VRF to isolate traffic between EPGs.

Answer

Define a bridge domain with L2 policies.

Question 10

Which TWO statements about Cisco TrustSec in a data center are true?

Accepted Answer

SXP (SGT Exchange Protocol) is used to propagate SGTs across network devices that do not support inline tagging.. Option C is correct because SXP (SGT Exchange Protocol) is a TCP-based protocol that carries SGT-to-IP mappings to devices that cannot perform inline SGT tagging, such as older switches or non-TrustSec-capable platforms, allowing policy enforcement at those points. Option E is correct because TrustSec's core function is assigning Security Group Tags (SGTs) to traffic and using Security Group ACLs (SGACLs) on enforcement devices to permit or deny flows based on source and destination SGTs rather than IP addresses. Option A is not correct because TrustSec does not replace 802.1X; it typically relies on 802.1X, MAB, or other identity mechanisms to authenticate endpoints and then assigns SGTs after authentication. Option B is not correct because SGTs are 16-bit values (with a reserved range), not 32-bit values. Option D is not correct because TrustSec is a general campus and data center architecture for wired and wireless networks, not one primarily designed for wireless.

Answer

TrustSec can replace 802.1X authentication in the data center.

Answer

SGTs are 32-bit values assigned to users or devices.

Answer

TrustSec is primarily designed for wireless networks.

Question 11

Refer to the exhibit. A server connected to Ethernet1/1 is experiencing intermittent connectivity. The server sends BPDUs, causing the switch to place the port into a blocking state. Which configuration change should be made to prevent this while maintaining rapid convergence?

Accepted Answer

Add 'spanning-tree bpdufilter enable' on the interface.. Enabling BPDU filter on the interface prevents the switch from processing BPDUs received from the server, which stops the port from being placed into a blocking state due to BPDU reception. This maintains rapid convergence because the port remains configured as an edge port (spanning-tree port type edge trunk), allowing it to transition directly to forwarding without spanning-tree negotiation.

Answer

Add 'spanning-tree guard loop' to the interface.

Answer

Remove the 'spanning-tree port type edge trunk' command and configure 'spanning-tree port type normal'.

Answer

Change the port type to 'spanning-tree port type network trunk'.

Question 12

A company runs a multi-tenant data center using Cisco ACI with multiple tenants. Each tenant has its own VRF and EPGs. The security policy requires that tenant A's web servers (EPG web_tenantA) be accessible from tenant B's application servers (EPG app_tenantB) only via HTTPS (TCP 443). The ACI fabric is configured with contracts. The administrator has created a contract with a filter for HTTPS (tcp dstPort 443) and applied it as a provider contract on EPG web_tenantA and as a consumer contract on EPG app_tenantB. However, traffic from tenant B's app servers to tenant A's web servers is being dropped. The administrator has verified that the contracts are applied correctly and the filter is correct. What is the most likely cause of the traffic drop?

Accepted Answer

The contract is not marked as 'shared' between tenants; a shared contract must be created and both EPGs must be in the same VRF or use a shared VRF.. In Cisco ACI, contracts are local to a VRF by default. For inter-tenant communication where each tenant has its own VRF, the contract must be explicitly marked as 'shared' and both EPGs must either be in the same VRF or use a shared VRF that allows cross-VRF policy enforcement. Without this, the contract filter is not applied across VRFs, causing traffic to be dropped even though the contract and filter are correctly configured.

Answer

The EPGs are not in the same bridge domain; they must be in the same bridge domain to communicate.

Answer

The VRF of tenant A and tenant B must have route leaking configured to allow inter-VRF routing.

Answer

The filter for HTTPS must also include the source port range 49152-65535 for ephemeral ports.

Question 13

Order the steps to upgrade the software on a Cisco Nexus switch using ISSU.

Accepted Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then perform a compatibility check, then issue the 'install all' command, then reload the switch.. ISSU requires image copy, boot variable, compatibility check, upgrade command, and reload.

Answer

Copy the new image to the bootflash, then perform a compatibility check, then set the boot variable to the new image, then issue the 'install all' command, then reload the switch.

Answer

Copy the new image to the bootflash, then set the boot variable to the new image, then issue the 'install all' command, then perform a compatibility check, then reload the switch.

Answer

Set the boot variable to the new image, then copy the new image to the bootflash, then perform a compatibility check, then issue the 'install all' command, then reload the switch.

Question 14

A server team reports that after connecting a new server to a switchport, the server can receive traffic but cannot send traffic. The port is configured with port security. What is the most likely cause?

Accepted Answer

The port security violation mode is set to protect. When port security violation mode is set to 'protect', the switch drops traffic from unauthorized MAC addresses without generating a syslog message or incrementing the violation counter. In this scenario, the server can receive traffic because the switch still forwards broadcast and unknown unicast frames to the port, but the server's transmitted frames are silently dropped because the switch does not learn the server's MAC address or forward its frames. This matches the symptom of one-way communication where the server can receive but not send.

Answer

The port is in errdisable state

Answer

The port security maximum is set to 1 and another device is connected

Answer

The server MAC address is not in the allowed list

Question 15

A company uses Cisco ISE for 802.1X authentication on data center edge switches. After a recent upgrade, some endpoints that previously authenticated successfully now fail. The ISE logs show the endpoint is in the wrong authorization profile. What is the most likely cause?

Accepted Answer

The endpoint posture assessment is failing. A failing posture assessment can cause ISE to apply a different authorization profile (e.g., a quarantine or remediation profile) instead of the expected one, even though the endpoint previously authenticated successfully. Posture checks occur after 802.1X authentication and can change the authorization result based on endpoint compliance, which aligns with the symptom of the endpoint being in the wrong profile after an upgrade.

Answer

The switch port is in multi-authentication mode

Answer

The switch has incorrect RADIUS shared secret

Answer

The ISE policy is using a different identity source

Question 16

Refer to the exhibit. A DHCP server is connected to Ethernet1/1 and a client in VLAN 10 is connected to Ethernet1/2. The client obtains an IP address. Which statement is best supported?

Accepted Answer

The DHCP server port is trusted for all VLANs. When a DHCP server is connected to a switch port and clients in different VLANs (like VLAN 10) obtain IP addresses, the switch must trust the DHCP server port for all VLANs. This is typically achieved by configuring the port as a DHCP snooping trusted port or by using an IP helper address on the VLAN interface. Without trust, DHCP snooping would drop server responses on untrusted ports, preventing the client from obtaining an address.

Answer

The DHCP server is in VLAN 20

Answer

The DHCP client is using a static IP address

Answer

The DHCP client MAC address is not verified

Question 17

Refer to the exhibit. A web server in VLAN 10 with IP 10.0.0.5 is experiencing connectivity issues. Clients from subnet 10.0.0.0/24 can access the server, but clients from other subnets cannot. What is the most likely cause?

Accepted Answer

The ACL denies all traffic from other subnets. The exhibit shows an ACL applied to the VLAN 10 SVI that permits HTTP traffic only from the 10.0.0.0/24 subnet. Since clients from other subnets are denied, the ACL is explicitly blocking all traffic from those subnets, which matches option C. This is the most likely cause because the server is reachable from the local subnet but not from elsewhere, indicating a filtering issue rather than a routing or gateway problem.

Answer

The ACL is missing a permit for return traffic

Answer

The server's default gateway is incorrect

Answer

The ACL permits HTTP only from the local subnet

Question 18

A network administrator configures DHCP snooping on a Nexus 9000 switch. The legitimate DHCP server is connected to Ethernet 1/1. An unauthorized DHCP server is detected on Ethernet 1/2. Which action should be taken to prevent the unauthorized server from offering IP addresses?

Accepted Answer

Set Ethernet 1/1 as a trusted port. DHCP snooping uses the concept of trusted and untrusted ports. By default, all ports are untrusted. Setting Ethernet 1/1, where the legitimate DHCP server is connected, as a trusted port allows DHCP server messages (OFFER, ACK, etc.) from that port to be forwarded. All other ports, including Ethernet 1/2, remain untrusted, so any DHCP server messages received on them are dropped, effectively blocking the unauthorized DHCP server.

Answer

Enable the DHCP snooping information option

Answer

Set Ethernet 1/2 as a trusted port

Answer

Disable DHCP snooping globally

Question 19

Two Nexus switches are configured for MACsec using MKA. The link between them is up, but MKA does not establish. Which issue is most likely?

Accepted Answer

Mismatched cipher suites. MKA (MACsec Key Agreement) requires both endpoints to agree on a cipher suite during the CAK (Connectivity Association Key) exchange. If the cipher suites are mismatched (e.g., one switch uses GCM-AES-128 and the other uses GCM-AES-256), the MKA negotiation will fail, and the link will remain up but unsecured. This is the most common cause of MKA not establishing on an otherwise functional Layer 2 link.

Answer

Different MTU sizes

Answer

Switches are in different VLANs

Answer

Mismatched MKA key strings

Question 20

In a private VLAN configuration, a host in a community VLAN needs to communicate with a host in the primary VLAN. What configuration is required on the switch?

Accepted Answer

The host in primary VLAN must be on a promiscuous port. In a private VLAN configuration, a host in a community VLAN can communicate with a host in the primary VLAN only if the host in the primary VLAN is on a promiscuous port. The promiscuous port can communicate with all other ports in the private VLAN, including community and isolated ports, enabling inter-VLAN traffic through a Layer 3 gateway or a server connected to that port.

Answer

The host in community VLAN must be on an isolated port

Answer

The host in community VLAN must be on a promiscuous port

Answer

The host in primary VLAN must be on a community port